Skip to main content

New Windows 0-Day Exploit Active

Google security officials are advising Windows users to ensure they’re using the latest version 10 of the Microsoft operating system to protect themselves against a “serious” unpatched vulnerability that attackers have been actively exploiting in the wild. Unidentified attackers have been combining an exploit for the unpatched local privilege escalation in Windows with one for a separate security flaw in the Chrome browser that Google fixed last Friday. While that specific exploit combination won’t be effective against Chrome users who are running the latest browser version, the Windows exploit could still be used against people running older versions of Windows. Google researchers privately reported the vulnerability to Microsoft, in keeping with its vulnerability disclosure policy.

The flaw, which resides in the Windows win32k.sys kernel driver, gives attackers a means to break out of security sandboxes that Chrome and most other browsers use to keep un-trusted code from interacting with sensitive parts of an OS. Attackers combined an exploit for this vulnerability with an exploit for the use-after-free bug in Chrome’s FileReader component. The Windows vulnerability is a NULL pointer dereference in win32k!MNGetpItemFromIndex when the NtUserMNDragOver() system call is called under specific circumstances.

In short, this is a privilege escalation type of threat. The hacker gains access to the local users machine and then all the damage is done there.

Comments

Post a Comment

Popular posts from this blog

Foldable Phones are the Future?

What the hottest thing in smartphone tech today? Foldable smartphones. Yep, that's right. We have officially entered the Sci-Fi era, where now screens have no limits! Huawei, a smartphone manufacturing company based in China has just announced a new smartphone to battle it's rival Samsung's Galaxy Fold. The Huawei Mate X, taking a totally different approach compared to Samsung device, is putting the display on the outside of the phone instead of on the inside, and this comes with a number of pros and cons. The Mate X has a massive 8-inch 2480×2200 OLED display that wraps around the phone body. When open, that's a bigger screen than the Galaxy Fold, which is only 7.3-inches. When closed, the Mate X's 8-inch display splits into a 6.6-inch, 2480×1148 display section on the front, and a 6.38-inch, 2480×892 section on the back. So you can decide which side of the phone you would like to use at any given time. Then, if you want something bigger, you just open up the main ...
Post a Comment
Read more

Android and Malware a Rising Concern

I think it is safe to say that between the Google Play Store on Android and the App Store on iOS, that Google's app market seems to be the most susceptible to malware attacks. The main reason being that Android is Open Source software, meaning that the software that runs on these phones are free for the public to see and use for themselves. While this is a way to be fully transparent with your companies software, it does put you at risk for more attacks. Hackers can study the code and find certain flaws that they can exploit and do malicious things. Getting an app on the Google Play store is an easy process, you have to create some accounts and enter in content information, etc. Then your app will be posted online for everyone to download. Some app developers with bad intentions seem to be hiding malicious content inside what looks like harmless game apps. Everything looks and functions properly, but in the background malware files are being loaded onto your phone. You go on about ...
Post a Comment
Read more